CVE-2021-32759

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for this Issue.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Aug 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327606.3containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-CVE-2021-327617.5Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow e CVE-2021-327628.8Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnera CVE-2021-327636.5OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProjec CVE-2021-327645.4Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be sus CVE-2021-327658.8Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provide CVE-2021-327665.3Nextcloud Text is an open source plaintext editing application which ships with the nextcloud server. In affected versions the Nextcloud Tex CVE-2021-327676.5TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 throug CVE-2021-327686.1TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, CVE-2021-327697.5Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in version CVE-2021-32777.2Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in CVE-2021-327707.5Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic